## Chapter 10 — A recent-backup bit is not a restore ### Lesson map Lesson 10. Map, example, EX056. ```mermaid flowchart TD B["backup cell is 1"] --> R["A recency claim about the last seven days"] T["A restore test"] --> F["A deleted file, and an older version"] R --> D{"Does the test flip a zero?"} F --> D D -->|No| K["Zeros stay FB03, FB07, FB10"] ``` Recency, a recycle-bin restore, and a previous version are three operations. ### Logical drawing ```text backup<=7d zeros FB03, FB07, FB10 narrative tests one deleted test file from the recycle bin one older version of a document retention stated previous versions, 30 days not stated a separate recycle-bin lifetime ``` ### Learning outcomes After this chapter, you should be able to: 1. Distinguish a seven-day recency bit from an executed restore. 2. Keep the two successful tests in their own prose. 3. State the thirty-day limit without inventing a second retention number. ### 10.1 Recency says a copy was recent. A restore says a copy came back. The fifth cell is named `backup<=7d`. A `1` means the matrix recorded a backup within seven days. A `0` means it did not. The zeros are `FB03`, `FB07`, and `FB10`, so the print reads `backup<=7d 9/12`. Nothing in that reduction opens the cloud service, selects an object, or writes it back. CIS Controls v8 Control 11 includes testing that data can be recovered, precisely because a backup that has never been restored may fail when it is needed. The control's point is the gap between the bit and the test. Chapter 3 describes two tests, and they are not the same operation. Leah deletes a test file and restores it from the cloud service's recycle bin. She also restores an older version of a document. Both succeed, as narrative. The first proves that a deleted object was still held as a deleted object. The second proves that an existing object had a retained earlier revision. Previous versions are kept for thirty days. The book uses that window to state a limit: a file damaged and not noticed for six weeks could not be recovered this way. Leah records the limit for the trustees rather than claiming that backups cover every loss. The manuscript does not print a separate lifetime for the recycle bin. A reader who writes "recycle bin, thirty days" has copied the version-history number onto a different store. The three zero rows are also the laptops that were keeping documents only on the desktop. Encryption, if it had been the missing control, would stop a thief from reading those files and would not return them to the food bank. Moving the folders into the cloud service is the availability step, and it is prose. A passed restore does not edit `lab_quickcheck.py`. SP 800-53's CP-9 names system backup in the catalog. The food bank's evidence is the bit, the two tests, and the thirty-day window. It is not a contingency-plan assessment, and it is not a second print in which the three zeros have become ones. ### 10.2 Worked example | Operation | What it shows | Decision | |---|---|---| | Column sum `9/12` | Nine ones under the seven-day predicate | Keep the print | | Recycle-bin restore of a test file | One deleted object came back | Keep as prose | | Older-version restore | One revision came back | Keep as prose | | "Both stores retain objects for thirty days." | Only previous versions have that number | Refuse | > **Synthetic case.** The six-week limit stays the trustees' recorded limit. No new retention figure is added. ### Errors and limits A recent copy that has never been restored is still only a recency bit. Control 11 is why the test exists. ### Apply - **EX056 — Bit or test?** The backup zeros are FB03, FB07 and FB10. Two restores succeeded in the story, and previous versions last thirty days. May you print backup 12 of 12, and may you assign thirty days to the recycle bin? *Rubric:* 3 = no; the zeros and the 9 of 12 stay; the two tests stay prose and stay different operations; thirty days stays on previous versions only; six weeks stays the stated gap;; 2 = the print and the retention stay unmixed;; 1 = one point;; 0 = none. ### Continue studying — lesson 10 (chapter 10 of 20) [← Chapter 09](#ch-09) · [Course chapter index](../SUBJECTS.md) · [Chapter 11 →](#ch-11) Continue to the next authored lesson. ## Worked answers **EX056.** No. The zeros stay FB03, FB07 and FB10, and the print stays 9 of 12. The two tests stay prose and stay different operations. Thirty days stays on previous versions. Six weeks stays the stated gap.